provider "alicloud" {
  region                = local.region
}

#first create alicloud oss and ots services storage terraform state and lock
#ots create table name "terraform_statelock",setting master key "T_ID",type "String"
terraform {
  required_version      = "~> 0.12"  
  backend "oss" {
    bucket              = "deeproute-terraform-resources"
    key                 = "prod/services/infrastructure"
    tablestore_endpoint = "https://terraform-status.cn-shenzhen.ots.aliyuncs.com"
    tablestore_table    = "terraform_statelock_table"    
    region              = "cn-shenzhen"
  }
}

resource "alicloud_ots_instance" "main" {
  name                  = "terraform-status"
  accessed_by           = "Any"  #网络限制[Any、Vpc、ConsoleOrVpc]
  tags                  = local.tags
}

resource "alicloud_ots_table" "main" {
  instance_name                 = alicloud_ots_instance.main.name
  table_name                    = "terraform_statelock_table"
  primary_key {
      name = "T_ID"
      type = "String"
    }
  time_to_live                  = -1
  max_version                   = 1
  deviation_cell_version_in_sec = 1
}

module "terraform_resources_oss" {
  source                        = "../../../modules/alicloud/oss"
  bucket_name                   = "deeproute-terraform-resources"
  storage_class                 = "IA"  #可选[IA、Standard、Archive]
}

module "backup_oss" {
  source                        = "../../../modules/alicloud/oss"
  bucket_name                   = "deeproute-backup-resources"
  storage_class                 = "IA"  #可选[IA、Standard、Archive]
}

# module "ssl" {
#   source                              = "../../../modules/alicloud/ssl"
#   ssl_name                            = "deeproute-ai-cn"
#   ssl_cert                            = "/home/qianghu/.cert/deeproute.ai/deeproute.ai.pem"
#   ssl_key                             = "/home/qianghu/.cert/deeproute.ai/deeproute.ai.key"
# }

# module "slb_cert" {
#   source                              = "../../../modules/alicloud/slb-cert"
#   slb_cert_name                       = "deeproute-ai-cn"
#   slb_cert                            = "/home/qianghu/.cert/deeproute.ai/deeproute.ai.pem"
#   slb_key                             = "/home/qianghu/.cert/deeproute.ai/deeproute.ai.key"
# }

module "vpc" {
  source                = "git@code.deeproute.ai:deeproute/ops-terraform.git//alicloud/vpc?ref=module.v1.0.2"
  vpc_name              = local.fullname
  vpc_cidr              = "192.168.0.0/16"
}

//prod-infra-vswitch
module "vswitch-d" {
  source                = "git@code.deeproute.ai:deeproute/ops-terraform.git//alicloud/vswitch?ref=module.v1.0.2"
  vpc_id                = module.vpc.vpc_id
  vswitch_cidr          = ["192.168.1.0/24"]
  zone_id               = "cn-shenzhen-d"
  vswitch_name          = local.fullname
}

module "vswitch-e" {
  source                = "git@code.deeproute.ai:deeproute/ops-terraform.git//alicloud/vswitch?ref=module.v1.0.2"
  vpc_id                = module.vpc.vpc_id
  vswitch_cidr          = ["192.168.2.0/24"]
  zone_id               = "cn-shenzhen-e"
  vswitch_name          = local.fullname
}

module "vswitch-f" {
  source                = "git@code.deeproute.ai:deeproute/ops-terraform.git//alicloud/vswitch?ref=module.v1.0.2"
  vpc_id                = module.vpc.vpc_id
  vswitch_cidr          = ["192.168.3.0/24"]
  zone_id               = "cn-shenzhen-f"
  vswitch_name          = local.fullname
}

//prod-map-vswitch
module "map-vswitch-d" {
  source                = "git@code.deeproute.ai:deeproute/ops-terraform.git//alicloud/vswitch?ref=module.v1.0.2"
  vpc_id                = module.vpc.vpc_id
  vswitch_cidr          = ["192.168.7.0/24"]
  zone_id               = "cn-shenzhen-d"
  vswitch_name          = "${local.env}-map"
}

module "map-vswitch-e" {
  source                = "git@code.deeproute.ai:deeproute/ops-terraform.git//alicloud/vswitch?ref=module.v1.0.2"
  vpc_id                = module.vpc.vpc_id
  vswitch_cidr          = ["192.168.8.0/24"]
  zone_id               = "cn-shenzhen-e"
  vswitch_name          = "${local.env}-map"
}

module "map-vswitch-f" {
  source                = "git@code.deeproute.ai:deeproute/ops-terraform.git//alicloud/vswitch?ref=module.v1.0.2"
  vpc_id                = module.vpc.vpc_id
  vswitch_cidr          = ["192.168.9.0/24"]
  zone_id               = "cn-shenzhen-f"
  vswitch_name          = "${local.env}-map"
}


resource "alicloud_key_pair" "main" {
  key_name              = "devops-key"
}

module "ecs_policy" {
  source                        = "git@code.deeproute.ai:deeproute/ops-terraform.git//alicloud/ram/policy?ref=module.v1.0.2"
  ram_policy_name               = local.fullname
  ram_policy_document           = <<EOF
  {
    "Statement": [
      {
        "Action": [
          "oss:ListObjects",
          "oss:GetObject"
        ],
        "Effect": "Allow",
        "Resource": [
          "acs:oss:*:*:${module.terraform_resources_oss.oss_id}",
          "acs:oss:*:*:${module.terraform_resources_oss.oss_id}/*"
        ]
      }
    ],
      "Version": "1"
  }
  EOF
}

module "ecs_role" {
  source                        = "git@code.deeproute.ai:deeproute/ops-terraform.git//alicloud/ram/role?ref=module.v1.0.2"
  ram_role_name                 = local.fullname
  ram_role_document             = <<EOF
  {
    "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
          "Service": [
            "apigateway.aliyuncs.com", 
            "ecs.aliyuncs.com",
            "cr.aliyuncs.com"
          ]
        }
      }
    ],
    "Version": "1"
  }
  EOF

  enable_custom_policy                 = true
  attach_custom_policy_name            = ["${module.ecs_policy.ram_policy_name}"] 
  enable_system_policy                 = true
  attach_system_policy_name            = ["AliyunContainerRegistryFullAccess"]     
}